An employee of Metro Plus Health Plan, Inc., emailed two unencrypted files to her personal and work email addresses containing the electronic protected health information (ePHI) of 31,980 members of the health plan, which included members’ names, addresses, dates of birth and social security numbers. Metro Plus Health Plan, the covered entity (CE), provided breach notification to HHS, the media, and affected individuals, including the offer of one year of credit monitoring services. The CE also documented the unauthorized disclosure of its members’ ePHI for accounting of disclosure purposes. Following the breach, the CE conducted an internal investigation, sanctioned the employee, ensured the ePHI was deleted from the employee’s personal email account, and reminded its employees regarding prohibitions against emailing members’ ePHI to personal email accounts. Additionally, the CE is expected to conduct a risk analysis and implement a corresponding risk management plan as required by the Security Rule.
